Software Composition Analysis
Software composition analysis identifies the third-party components in software and compares them with vulnerability and policy information. It helps you decide which component risks affect a specific product and release.
itOffensive security and application security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Software Composition Analysis
Software composition analysis, or SCA, identifies software components and assesses the risk they bring into a product. It covers third-party and open-source code, including dependencies that arrive through other dependencies.
An SCA result is evidence, not a verdict. A tool can identify a component and match it with known vulnerability data. You still confirm the identity, affected version, released artifact, and risk in your environment.
The mental model
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://owasp.org/www-community/Component_Analysis
Supports
- Component analysis identifies potential risk from third-party and open-source components
- SCA is the software-only subset of component analysis
- Accurate component inventory is necessary for risk identification
- https://devguide.owasp.org/en/05-implementation/02-dependencies/01-dependency-check/
Supports
- Dependency-Check provides command-line SCA
- The tool identifies third-party libraries and checks known vulnerabilities
- https://www.cisa.gov/sites/default/files/2024-08/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_RECOMMENDED_PRACTICES_FOR_SOFTWARE_BILL_OF_MATERIALS_CONSUMPTION-508.pdf
Supports
- SBOM data supports software supply chain risk decisions
- SCA and scanning tools can verify SBOM accuracy and support vulnerability analysis
- Component relationships and inventory inform enterprise workflows
- https://csrc.nist.gov/pubs/sp/800/218/final
Supports
- Secure development includes acquisition and maintenance of well-secured third-party components
- Vulnerability information requires assessment and remediation through the software lifecycle
- https://pages.nist.gov/nccoe-devsecops/notational-reference-model.html
Supports
- DevSecOps development practices can run SCA before source-control changes
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Curated ecosystem entries include Syft, Grype, and OWASP Dependency-Track